About AymanC

AymanC · 09-29-2023

Hi All,I'm looking for a way to fulfill reporting requirements, potentially through dashboards. I understand that going into the "Alerts" section, this allows you to export data with filters set. However, this is a manual process and don't include da...

AymanC

A hypothetical use case where the logic you're referring to could be used could be where a scheduled task has been modified, but a scheduled task hasn't been enabled thereafter within a 30 minute period period. Where the condition $modified is trigge...

AymanC

Hi CyberSnacker82,The use of metrics within Risk Analytics is probably better suited for use cases similar to this - https://cloud.google.com/chronicle/docs/detection/metrics-functionsHowever, the following rule logic should work, and identifies two ...

AymanC

Hi @Indrajeet_D Although is not a video, this is a great blog post by thatsiemguy which helps!https://medium.com/@thatsiemguy/parsing-101-best-practices-tips-c2e8b7ce9db8Kind Regards,Ayman C

AymanC

You could create a rule, to match across the log source, and identify if there's at least 1 event being generated. And then utilise the runretrohunt API endpoint (https://cloud.google.com/chronicle/docs/reference/detection-engine-api#runretrohunt), l...

AymanC

Hey @Indra,Does this help at all - performing a raw log (it could be a regex with a .*), then applying a procedural filter on 'Event Type' to 'Unparsed Log'.Kind Regards,Ayman C

My Stats

kishore-hl's Bio

Badges AymanC Earned

Recent Activity

Reporting through Dashboards

Re: Trying to understand sliding window in YARA L

Re: Understanding YARA-L Rules

Re: Help! Looking for Video Tutorial on Writing Parsers from Scratch in Google Chronicle

Re: Silent log source detection

Re: Requesting Assistance : Identifying Unparsed Logs in Chronicle SIEM UI